Organizations may host their websites and other applications using their own servers in data centers located on the organizations' property. Such on-premises servers allow the organizations strict control of their infrastructure. Unfortunately, a surge of user demand might overwhelm an organization's dedicated servers, causing their applications to be unavailable or even to crash. Organizations would have to purchase enough servers to meet this demand surge or risk losing customers and developing a bad online reputation.
Organizations could also purchase or rent servers from an outsourced infrastructure provider, perhaps to reduce costs. The infrastructure provider might host servers for many different organizations. Additional servers could be made available for use by an organization experiencing heavy demand. Since different organizations experience demand surges at different times, spare servers could be shared to provide surge capacity for many different organizations, spreading the cost of the spare servers over all of the organizations. Costs can be lowered by using off-premises servers, but organizations do lose some direct control compared with dedicated on-premises servers.
Rather than have physical servers dedicated to one of their customers (a subscribing organization, or simply a subscriber), an infrastructure provider might choose to offer virtual servers to their subscribers. A virtualization host (vHost), or hypervisor, controlled by the staff of the infrastructure provider allows subscribers to set up many virtual machine instances (VMs) on a single physical server. The number of virtual machines in use by a subscriber can vary over time as demand fluctuates. Virtual machines can even migrate or move from one vHost (i.e. physical server) to another using a process known as guest migration. One example of guest migration is vMotion by VMware.
There are a number of these outsourced infrastructure service providers that offer these kinds of cloud computing services to their subscribers. Cloud computing provides convenient, on-demand access to a shared pool of configurable computing resources (networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service-provider interaction. Using various software tools, a subscriber can provision resources from the shared pool automatically without action by the staff of the cloud computing provider. The cloud computing resources are pooled and shared among all subscribers with resources dynamically re-assigned according to end-user demand. Resources are often located in many different remote geographical locations.
The cloud computing resources can be rapidly provisioned to meet demand surges, allowing the subscribers' resources to be scaled up and down as demand fluctuates. Such resource usage is monitored and reported so that subscribers may be billed only for actual usage.
Software as a Service (SaaS) is an application delivery model that enables organizations to subscribe to software application services running at the SaaS provider. These SaaS applications can be accessed across the Internet through web browsers or other clients. The subscriber does not control the underlying servers, storage, network, or operating systems. Some outsourced infrastructure providers such as those that offer on-demand cloud computing services have built infrastructure control applications and application program interfaces (APIs) that enable subscribers to interact with their infrastructure in a manner similar to that of SaaS applications. These kinds of outsourced infrastructure providers are often referred to as an Infrastructure as a Service (IaaS) provider. Examples of IaaS providers include Amazon, Linode, and Rackspace, and examples of their products include Amazon's Web Services Elastic Compute Cloud (EC2), Linode, and Rackspace Cloud Hosting.
Many organizations, as they begin to take advantage of IaaS offerings, may use a hybrid approach. The organization may have company-owned on-premises servers and also subscribe to one or more cloud computing IaaS providers. The organization may use a combination of physical and virtual servers, both on-premises and off-premises.
Data may need to be transferred between on-premises servers and off-premises servers. These servers could be either physical or virtual. Such hybrid clouds pose various challenges, especially for networking, since the cloud service provider still controls their underlying hardware infrastructure such as the servers and networks. The subscriber does not control the underlying hardware or networks at the cloud service provider.
FIG. 1 shows a prior-art hybrid cloud network. An organization such as a company that has a web site or application that they wish to deploy in the cloud, has company-owned servers located on company property at on-premises location 104. The on-premises servers can include some dedicated servers that are physical machines, such as physical node 12, and other dedicated servers that run a virtualization host (vHost or hypervisor) software, such as VMWare or Xen, originally developed by the University of Cambridge Computer Laboratory. The virtualization host software runs several virtual-machine nodes, VM nodes 14, which can each run applications to service client requests from Internet 100.
The organization also rents dedicated physical servers at hosted-server location 106 to run applications that service user requests from Internet 100. These servers include hosted physical nodes 13, which can be hosted by hosted server providers such as RackSpace. Other services could be provided by hosted-server location 106 such as cloud services (not shown) or co-location servers that are owned by the organization, not the provider.
The organization also subscribes to an IaaS provider which offers cloud computing resources from cloud-computing provider 108. Cloud-computing provider 108 could be EC2 or Rackspace Cloud, Linode, Slicehost, Terramark or any other similar IaaS provider. Cloud-computing provider 108 provides cloud services on-demand by running IaaS software that allows subscribers to automatically provision virtual machines instances such as VM nodes 14.
Client applications such as web browsers of remote users from Internet 100 can access the nodes that are configured as webservers, while the rest of the nodes can communicate with each other to process application data or serve database requests as needed. For example, a webserver application running on VM node 14 on cloud-computing provider 108 may need to communicate with a database application running on VM node 14 at on-premises location 104. Another webserver application running on hosted physical node 13 at hosted-server location 106 may also need to communicate with a database application running on physical node 12 at on-premises location 104.
IP Packets are sent over Internet 100 using Internet Protocol (IP) addresses and layer-3 routing of IP packets. Routers 22 transfer packets to and from local networks at on-premises location 104, hosted-server location 106, and cloud-computing provider 108. These local networks are usually layer-2 Ethernet networks that use Media-Access-Controller (MAC) addresses, sometimes referred to as Ethernet addresses. For example, layer-2 physical network 20 is a Local-Area-Network (LAN) that connects network interface controllers (NIC) 18 and router 22. The virtualization host may provision virtual NIC VNIC 16 for each virtual machine VM node 14, and connect each VNIC 16 to a physical NIC 18 for the virtual servers.
Cloud-computing provider 108 may have internal network 102 that uses router 22 to connect its own systems and possibly other datacenters to Internet 100. Internal network 102 could be a combination of wide area network (WAN) links connecting geographically distributed datacenters as well as LANs. Internal network 102 also includes the physical NICs on the IaaS host (not shown) that are necessary to connect VNIC 16 for instances of VM nodes 14 running on the IaaS host to an internal LAN connected to router 22 and provide access to Internet 100. Internal network 102 could be part of the IaaS provider's own network or even part of a different network provider's network for wide area connectivity such as Level 3 or AT&T.
The implementation details of internal network 102 are unknown to subscribers and therefore could use any combination of layer 3 routing and layer 2 switching technologies. Subscribers to cloud service provider 108 have no control over internal network 102 and therefore cannot change the configuration in any way.
Sometimes data needs to be transferred among servers at different locations. For example, an organization may keep its customer database secure at on-premises location 104 and only allow queries into the database from applications running on external servers such as at hosted-server location 106 or cloud-computing provider 108. Data may need to be transferred from physical node 12 to hosted physical node 13. A dedicated trunk connection may not be cost effective or practical between on-premises location 104 and hosted-server location 106, so a virtual-private-network (VPN) can be established through Internet 100.
VPN tunnel 24 connects physical node 12 to hosted physical node 13 by establishing a tunnel through Internet 100. Application software running on physical node 12 sends a message to hosted physical node 13 using a virtual IP address for hosted physical node 13. VPN software encrypts and packages the message and translates the virtual IP address to a physical IP address of NIC 18 on hosted physical node 13. VPN software on hosted physical node 13 translates the physical IP addresses to virtual IP addresses and decrypts the message. VPN tunnel 24 can also send messages in the reverse direction by a similar process.
While effective, VPN tunnel 24 only connects two nodes in a point-to-point manner. Separate VPN tunnels need to be set up for each pair of nodes. Thus a large number of VPN tunnels 24, 25 may need to be configured, one for each pair of nodes. This configuration may be manual and time-consuming.
As additional instances of VM nodes 14 on cloud-computing provider 108 are created, additional VPN tunnels 25 may need to be set up manually if applications running on VM nodes 14 need to query databases on physical node 12 at on-premises location 104, as well as to every other node with which it needs to communicate. Each VPN tunnel 25 connects a VNIC 16 for one of VM nodes 14 to NIC 18 of physical node 12.
The administrative burden of creating these VPN tunnels causes some organizations to introduce a dedicated VPN gateway device whereby each node connects only to the gateway device, thereby simplifying VPN creation. However, this gateway device introduces additional latency as well as a potential performance bottleneck since the gateway needs to process all packets from all nodes. The hub and spoke topology required for these kinds of VPN tunnels precludes the use of specific network topologies that may be required for certain multi-tiered application deployment.
Even without a gateway device, fully meshed VPNs can sometimes impact performance. VPN software is often simply a user-level application which needs to translate individual network packets and encrypt data, which can easily slow a system down.
Ideally, rather than use layer-3 IP routing through VPN tunnels 24, 25, additional VM nodes 14 on cloud-computing provider 108 and at hosted server location 106 would appear to be on virtualized layer-2 network at on-premises location 104. Switching over layer-2 physical network 20 is performed by MAC (or Ethernet) addresses at layer-2, rather than IP addresses at layer-3.
It would thus be desirable for connections to VM nodes 14 on cloud-computing provider 108 and at hosted server location 106 to be virtualized to appear on a virtualized layer-2 network that includes layer-2 physical network 20 at on-premises location 104. This is more desirable than networking using only VPN tunnels, which are hard to maintain, restrict network topologies, and often introduce performance bottlenecks.
IEEE 802.1Q is a virtualized LAN standard known as a VLAN. A VLAN uses extra tag bits in the Ethernet header to specify a portion of a LAN as a sub-network segment. Thus a VLAN merely divides an existing LAN into smaller virtual LANs that are separate from one another and define their own ‘broadcast domain’. Separating LANs into smaller VLANs can improve LAN performance since certain kinds of traffic can be contained within a single broadcast domain.
What is desired is a virtual layer-2 network that connects remote nodes on a remote physical LAN to an on-premises LAN. A virtual network that switches at layer-2 using Ethernet addresses yet virtualizes remote nodes using virtual Ethernet addresses is desirable. Virtual layer-2 networking software for use by a cloud computing subscriber is desired to extend Infrastructure as a Service (IaaS) to virtual layer-2 networks. This allows a subscriber to configure their own layer-2 network. An IaaS user-configurable virtual network is desirable for virtual layer-2 switching.